Στις 8/3/2012 13:47, ο/η Alon Levy έγραψε:
>On Thu, Mar 08, 2012 at 01:23:02PM +0200, Georgios Petasis wrote:
>>Στις 8/3/2012 11:30, ο/η Alon Levy έγραψε:
>>>ok, if the VM runs on a separate pc, of course it doesn't work - I
>>>wrongly assumed it was on the same pc as virt-manager. You need to
>>>capture the interface that the spice connection is on - so the
>>>network connection, which would be em1 / eth0. Wireshark has a
>>>neat mode where it shows you the packets per interface before
>>>starting a capture on a specific interface
>>>(menu->capture->interfaces, or ctrl-i).
>>Dear Alon,
>>
>>I am a little confused.
>>I have a PC. I have started a VNC server on the pc. I run
>>virt-manager inside this vnc server. I run the VM from this
>>virt-manager (so virt-manager& VM run in the pc that the vnc server
>>runs).
>>And from a second pc, I have a vnc client, that I see all these.
>OK, I didn't understand correctly, thanks for the patience.
>
>>I have uploaded a capture from em1 here:
>>http://server.intellitech.gr/spice-em1.cap.bz2
>>
>So this one will be pointless since the spice connection is over
>loopback on your headless pc.
>
>So you are using wireshark on the headless PC via VNC?
Yes, wireshark runs on the same pc as the vnc server, virt-manager & the VM.
I control it through a vnc client, from another pc.
> I don't see any
>TCP connections being created, as I would expect if virt-manager starter
>the spice connection after the capture is started. Can you please make
>sure virt-manager is closed before you start the capture?
I have rebooted the pc, I have started wireshark, and then started
virt-manager & the VM. The VM booted (windows 7 64 bit), I pressed a
few keys, then I opened the start menu, some more key presses, and
finally I stopped the VM (normal shutdown from windows).
All this interaction is here:
http://server.intellitech.gr/spice-wholevm.cap.bz2
If something is still missing, I think that it is possible it does
not exist.
It's there, just the dissector thinks it VNC, but the initial bytes say
REDQ. Looking into it, thanks for the trouble.